CVE-2026-63768

CVE-2026-63768 affects cal.diy up to version 6.2.0. The issue is an open redirect in the conferencing OAuth callback endpoint triggered by crafting malicious state parameters, exploiting an unsigned state parameter and the onErrorReturnTo field to silently redirect users from the trusted domain t...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-9304

A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely...

CVE-2026-9349

A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument...

cal.diy 访问控制错误漏洞

cal.diy is an open-source calendar scheduling platform developed by Cal. Versions of cal.diy 4.9.4 and earlier contain a security vulnerability related to access control. This vulnerability stems from the getServerSideProps function in the Generic React API component file...

PT-2026-42905

A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument...

EUVD-2026-31540

A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely...

EUVD-2026-31539

A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this...

CVE-2026-9303 calcom cal.diy cross-site request forgery

A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this...

PT-2026-42884

Name of the Vulnerable Software and Affected Versions calcom cal.diy versions prior to 4.9.5 Description A flaw in the Logo API component allows for server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. The issue resides ...

PT-2026-42883

Name of the Vulnerable Software and Affected Versions calcom cal.diy versions prior to 4.9.5 Description A cross-site request forgery CSRF issue exists in an unknown function, allowing a remote attacker to initiate an attack. CSRF is a type of attack that tricks a victim into performing actions...

cal.diy 安全漏洞

cal.diy is an open-source calendar scheduling platform developed by Cal. Versions of cal.diy 4.9.4 and earlier contain security vulnerabilities, which stem from unknown functions and may lead to cross-site request forgery attacks...